Skip to content

Commit 7c84b77

Browse files
CopilotCopilot
authored
Add integration test for Set-SqlDscServerPermission command (#2265)
1 parent 62cb0b8 commit 7c84b77

File tree

4 files changed

+247
-0
lines changed

4 files changed

+247
-0
lines changed

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1313
- Added integration tests for `Remove-SqlDscAudit` command to ensure it functions
1414
correctly in real environments
1515
[issue #2241](https://github.com/dsccommunity/SqlServerDsc/issues/2241).
16+
- Added integration tests for `Set-SqlDscServerPermission` command to ensure it
17+
functions correctly in real environments
18+
[issue #2234](https://github.com/dsccommunity/SqlServerDsc/issues/2234).
1619
- Added integration tests for `Save-SqlDscSqlServerMediaFile` command to ensure
1720
it functions correctly in real environments
1821
[issue #2237](https://github.com/dsccommunity/SqlServerDsc/issues/2237).

‎azure-pipelines.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -314,6 +314,7 @@ stages:
314314
'tests/Integration/Commands/Test-SqlDscIsRole.Integration.Tests.ps1'
315315
'tests/Integration/Commands/Grant-SqlDscServerPermission.Integration.Tests.ps1'
316316
'tests/Integration/Commands/Get-SqlDscServerPermission.Integration.Tests.ps1'
317+
'tests/Integration/Commands/Set-SqlDscServerPermission.Integration.Tests.ps1'
317318
'tests/Integration/Commands/ConvertFrom-SqlDscServerPermission.Integration.Tests.ps1'
318319
'tests/Integration/Commands/Test-SqlDscServerPermission.Integration.Tests.ps1'
319320
'tests/Integration/Commands/Deny-SqlDscServerPermission.Integration.Tests.ps1'

‎tests/Integration/Commands/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ Get-SqlDscRole | 2 | 1 (Install-SqlDscServer), 0 (Prerequisites) | DSCSQLTEST |
6666
Test-SqlDscIsRole | 2 | 1 (Install-SqlDscServer), 0 (Prerequisites) | DSCSQLTEST | -
6767
Grant-SqlDscServerPermission | 2 | 1 (Install-SqlDscServer), 0 (Prerequisites) | DSCSQLTEST | Grants CreateEndpoint permission to role
6868
Get-SqlDscServerPermission | 2 | 1 (Install-SqlDscServer), 0 (Prerequisites) | DSCSQLTEST | -
69+
Set-SqlDscServerPermission | 2 | 1 (Install-SqlDscServer), 0 (Prerequisites) | DSCSQLTEST | -
6970
ConvertFrom-SqlDscServerPermission | 2 | 0 (Prerequisites) | - | -
7071
Test-SqlDscServerPermission | 2 | 1 (Install-SqlDscServer), 0 (Prerequisites) | DSCSQLTEST | -
7172
Deny-SqlDscServerPermission | 2 | 1 (Install-SqlDscServer), 0 (Prerequisites) | DSCSQLTEST | Denies AlterTrace permission to login (persistent)

‎tests/Integration/Commands/Set-SqlDscServerPermission.Integration.Tests.ps1‎

Lines changed: 242 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
[System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssignments', '', Justification = 'Suppressing this rule because Script Analyzer does not understand Pester syntax.')]
2+
param ()
3+
4+
BeforeDiscovery {
5+
try
6+
{
7+
if (-not (Get-Module -Name 'DscResource.Test'))
8+
{
9+
# Assumes dependencies have been resolved, so if this module is not available, run 'noop' task.
10+
if (-not (Get-Module -Name 'DscResource.Test' -ListAvailable))
11+
{
12+
# Redirect all streams to $null, except the error stream (stream 2)
13+
& "$PSScriptRoot/../../../build.ps1" -Tasks 'noop' 3>&1 4>&1 5>&1 6>&1 > $null
14+
}
15+
16+
# If the dependencies have not been resolved, this will throw an error.
17+
Import-Module -Name 'DscResource.Test' -Force -ErrorAction 'Stop'
18+
}
19+
}
20+
catch [System.IO.FileNotFoundException]
21+
{
22+
throw 'DscResource.Test module dependency not found. Please run ".\build.ps1 -ResolveDependency -Tasks noop" first.'
23+
}
24+
}
25+
26+
BeforeAll {
27+
$script:moduleName = 'SqlServerDsc'
28+
29+
Import-Module -Name $script:moduleName -Force -ErrorAction 'Stop'
30+
}
31+
32+
Describe 'Set-SqlDscServerPermission' -Tag @('Integration_SQL2017', 'Integration_SQL2019', 'Integration_SQL2022') {
33+
BeforeAll {
34+
# Starting the named instance SQL Server service prior to running tests.
35+
Start-Service -Name 'MSSQL$DSCSQLTEST' -Verbose -ErrorAction 'Stop'
36+
37+
$script:mockInstanceName = 'DSCSQLTEST'
38+
39+
$mockSqlAdministratorUserName = 'SqlAdmin' # Using computer name as NetBIOS name throw exception.
40+
$mockSqlAdministratorPassword = ConvertTo-SecureString -String 'P@ssw0rd1' -AsPlainText -Force
41+
42+
$script:mockSqlAdminCredential = [System.Management.Automation.PSCredential]::new($mockSqlAdministratorUserName, $mockSqlAdministratorPassword)
43+
44+
$script:serverObject = Connect-SqlDscDatabaseEngine -InstanceName $script:mockInstanceName -Credential $script:mockSqlAdminCredential -ErrorAction 'Stop'
45+
46+
# Use existing persistent principals created by earlier integration tests
47+
$script:testLoginName = 'IntegrationTestSqlLogin'
48+
$script:testRoleName = 'SqlDscIntegrationTestRole_Persistent'
49+
}
50+
51+
AfterAll {
52+
# Restore the expected state for shared test login that other tests depend on
53+
$script:loginObject = Get-SqlDscLogin -ServerObject $script:serverObject -Name $script:testLoginName -ErrorAction 'Stop'
54+
55+
# Revoke any permissions we may have set
56+
Revoke-SqlDscServerPermission -Login $script:loginObject -Permission 'ViewServerState' -Force -ErrorAction 'SilentlyContinue'
57+
Revoke-SqlDscServerPermission -Login $script:loginObject -Permission 'ViewAnyDatabase' -Force -ErrorAction 'SilentlyContinue'
58+
Revoke-SqlDscServerPermission -Login $script:loginObject -Permission 'ViewAnyDefinition' -Force -ErrorAction 'SilentlyContinue'
59+
Revoke-SqlDscServerPermission -Login $script:loginObject -Permission 'CreateAnyDatabase' -WithGrant -Force -ErrorAction 'SilentlyContinue'
60+
61+
# Restore the expected permissions that other tests depend on
62+
# Based on Grant test setup and Test command ExactMatch test expectations
63+
Grant-SqlDscServerPermission -Login $script:loginObject -Permission @('ViewServerState') -Force -ErrorAction 'SilentlyContinue'
64+
Grant-SqlDscServerPermission -Login $script:loginObject -Permission @('ViewAnyDefinition') -Force -ErrorAction 'SilentlyContinue'
65+
66+
Disconnect-SqlDscDatabaseEngine -ServerObject $script:serverObject
67+
68+
# Stop the named instance SQL Server service to save memory on the build worker.
69+
Stop-Service -Name 'MSSQL$DSCSQLTEST' -Verbose -ErrorAction 'Stop'
70+
}
71+
72+
Context 'When setting server permissions to Grant state for login' {
73+
BeforeEach {
74+
# Get the login object for testing
75+
$script:loginObject = Get-SqlDscLogin -ServerObject $script:serverObject -Name $script:testLoginName -ErrorAction 'Stop'
76+
77+
# Clean up any existing permissions
78+
Revoke-SqlDscServerPermission -Login $script:loginObject -Permission 'ViewServerState' -Force -ErrorAction 'SilentlyContinue'
79+
Revoke-SqlDscServerPermission -Login $script:loginObject -Permission 'ViewAnyDatabase' -Force -ErrorAction 'SilentlyContinue'
80+
Revoke-SqlDscServerPermission -Login $script:loginObject -Permission 'CreateAnyDatabase' -WithGrant -Force -ErrorAction 'SilentlyContinue'
81+
}
82+
83+
It 'Should set ViewServerState permission to Grant state' {
84+
$permissionSet = New-Object -TypeName 'Microsoft.SqlServer.Management.Smo.ServerPermissionSet'
85+
$permissionSet.ViewServerState = $true
86+
87+
$null = Set-SqlDscServerPermission -ServerObject $script:serverObject -Name $script:testLoginName -State 'Grant' -Permission $permissionSet -Force -ErrorAction 'Stop'
88+
89+
# Verify the permission was granted
90+
$result = Test-SqlDscServerPermission -Login $script:loginObject -Grant -Permission @('ViewServerState') -ErrorAction 'Stop'
91+
$result | Should -BeTrue
92+
}
93+
94+
It 'Should set multiple permissions to Grant state' {
95+
$permissionSet = New-Object -TypeName 'Microsoft.SqlServer.Management.Smo.ServerPermissionSet'
96+
$permissionSet.ViewServerState = $true
97+
$permissionSet.ViewAnyDatabase = $true
98+
99+
$null = Set-SqlDscServerPermission -ServerObject $script:serverObject -Name $script:testLoginName -State 'Grant' -Permission $permissionSet -Force -ErrorAction 'Stop'
100+
101+
# Verify the permissions were granted
102+
$result1 = Test-SqlDscServerPermission -Login $script:loginObject -Grant -Permission @('ViewServerState') -ErrorAction 'Stop'
103+
$result1 | Should -BeTrue
104+
105+
$result2 = Test-SqlDscServerPermission -Login $script:loginObject -Grant -Permission @('ViewAnyDatabase') -ErrorAction 'Stop'
106+
$result2 | Should -BeTrue
107+
}
108+
109+
It 'Should set permission to Grant state with WithGrant option' {
110+
$permissionSet = New-Object -TypeName 'Microsoft.SqlServer.Management.Smo.ServerPermissionSet'
111+
$permissionSet.CreateAnyDatabase = $true
112+
113+
$null = Set-SqlDscServerPermission -ServerObject $script:serverObject -Name $script:testLoginName -State 'Grant' -Permission $permissionSet -WithGrant -Force -ErrorAction 'Stop'
114+
115+
# Verify the permission was granted with grant option
116+
$result = Test-SqlDscServerPermission -Login $script:loginObject -Grant -Permission @('CreateAnyDatabase') -WithGrant -ErrorAction 'Stop'
117+
$result | Should -BeTrue
118+
}
119+
120+
It 'Should accept ServerObject from pipeline' {
121+
$permissionSet = New-Object -TypeName 'Microsoft.SqlServer.Management.Smo.ServerPermissionSet'
122+
$permissionSet.ViewAnyDatabase = $true
123+
124+
$null = $script:serverObject | Set-SqlDscServerPermission -Name $script:testLoginName -State 'Grant' -Permission $permissionSet -Force -ErrorAction 'Stop'
125+
126+
# Verify the permission was granted
127+
$result = Test-SqlDscServerPermission -Login $script:loginObject -Grant -Permission @('ViewAnyDatabase') -ErrorAction 'Stop'
128+
$result | Should -BeTrue
129+
}
130+
}
131+
132+
Context 'When setting server permissions to Deny state for login' {
133+
BeforeEach {
134+
# Get the login object for testing
135+
$script:loginObject = Get-SqlDscLogin -ServerObject $script:serverObject -Name $script:testLoginName -ErrorAction 'Stop'
136+
137+
# Clean up any existing permissions
138+
Revoke-SqlDscServerPermission -Login $script:loginObject -Permission 'ViewServerState' -Force -ErrorAction 'SilentlyContinue'
139+
Revoke-SqlDscServerPermission -Login $script:loginObject -Permission 'ViewAnyDefinition' -Force -ErrorAction 'SilentlyContinue'
140+
}
141+
142+
It 'Should set ViewServerState permission to Deny state' {
143+
$permissionSet = New-Object -TypeName 'Microsoft.SqlServer.Management.Smo.ServerPermissionSet'
144+
$permissionSet.ViewServerState = $true
145+
146+
$null = Set-SqlDscServerPermission -ServerObject $script:serverObject -Name $script:testLoginName -State 'Deny' -Permission $permissionSet -Force -ErrorAction 'Stop'
147+
148+
# Verify the permission was denied
149+
$result = Test-SqlDscServerPermission -Login $script:loginObject -Deny -Permission @('ViewServerState') -ErrorAction 'Stop'
150+
$result | Should -BeTrue
151+
}
152+
153+
It 'Should set permission to Deny state and ignore WithGrant parameter' {
154+
$permissionSet = New-Object -TypeName 'Microsoft.SqlServer.Management.Smo.ServerPermissionSet'
155+
$permissionSet.ViewAnyDefinition = $true
156+
157+
# WithGrant should be ignored for Deny state (should show warning)
158+
$null = Set-SqlDscServerPermission -ServerObject $script:serverObject -Name $script:testLoginName -State 'Deny' -Permission $permissionSet -WithGrant -Force -ErrorAction 'Stop'
159+
160+
# Verify the permission was denied
161+
$result = Test-SqlDscServerPermission -Login $script:loginObject -Deny -Permission @('ViewAnyDefinition') -ErrorAction 'Stop'
162+
$result | Should -BeTrue
163+
}
164+
}
165+
166+
Context 'When setting server permissions to Revoke state for login' {
167+
BeforeEach {
168+
# Get the login object for testing
169+
$script:loginObject = Get-SqlDscLogin -ServerObject $script:serverObject -Name $script:testLoginName -ErrorAction 'Stop'
170+
171+
# Set up known permissions to revoke
172+
$null = Grant-SqlDscServerPermission -Login $script:loginObject -Permission @('ViewServerState') -Force -ErrorAction 'Stop'
173+
$null = Grant-SqlDscServerPermission -Login $script:loginObject -Permission @('CreateAnyDatabase') -WithGrant -Force -ErrorAction 'Stop'
174+
}
175+
176+
It 'Should revoke ViewServerState permission' {
177+
$permissionSet = New-Object -TypeName 'Microsoft.SqlServer.Management.Smo.ServerPermissionSet'
178+
$permissionSet.ViewServerState = $true
179+
180+
$null = Set-SqlDscServerPermission -ServerObject $script:serverObject -Name $script:testLoginName -State 'Revoke' -Permission $permissionSet -Force -ErrorAction 'Stop'
181+
182+
# Verify the permission was revoked
183+
$result = Test-SqlDscServerPermission -Login $script:loginObject -Grant -Permission @('ViewServerState') -ErrorAction 'Stop'
184+
$result | Should -BeFalse
185+
}
186+
187+
It 'Should revoke permission with WithGrant option (cascade revoke)' {
188+
$permissionSet = New-Object -TypeName 'Microsoft.SqlServer.Management.Smo.ServerPermissionSet'
189+
$permissionSet.CreateAnyDatabase = $true
190+
191+
$null = Set-SqlDscServerPermission -ServerObject $script:serverObject -Name $script:testLoginName -State 'Revoke' -Permission $permissionSet -WithGrant -Force -ErrorAction 'Stop'
192+
193+
# Verify the permission with grant was revoked
194+
$result = Test-SqlDscServerPermission -Login $script:loginObject -Grant -Permission @('CreateAnyDatabase') -WithGrant -ErrorAction 'Stop'
195+
$result | Should -BeFalse
196+
}
197+
}
198+
199+
Context 'When setting server permissions for role' {
200+
BeforeEach {
201+
# Get the role object for testing
202+
$script:roleObject = Get-SqlDscRole -ServerObject $script:serverObject -Name $script:testRoleName -ErrorAction 'Stop'
203+
204+
# Clean up any existing permissions
205+
Revoke-SqlDscServerPermission -ServerRole $script:roleObject -Permission 'ViewServerState' -Force -ErrorAction 'SilentlyContinue'
206+
}
207+
208+
It 'Should set ViewServerState permission to Grant state for role' {
209+
$permissionSet = New-Object -TypeName 'Microsoft.SqlServer.Management.Smo.ServerPermissionSet'
210+
$permissionSet.ViewServerState = $true
211+
212+
$null = Set-SqlDscServerPermission -ServerObject $script:serverObject -Name $script:testRoleName -State 'Grant' -Permission $permissionSet -Force -ErrorAction 'Stop'
213+
214+
# Verify the permission was granted
215+
$result = Test-SqlDscServerPermission -ServerRole $script:roleObject -Grant -Permission @('ViewServerState') -ErrorAction 'Stop'
216+
$result | Should -BeTrue
217+
}
218+
219+
It 'Should set ViewServerState permission to Deny state for role' {
220+
$permissionSet = New-Object -TypeName 'Microsoft.SqlServer.Management.Smo.ServerPermissionSet'
221+
$permissionSet.ViewServerState = $true
222+
223+
$null = Set-SqlDscServerPermission -ServerObject $script:serverObject -Name $script:testRoleName -State 'Deny' -Permission $permissionSet -Force -ErrorAction 'Stop'
224+
225+
# Verify the permission was denied
226+
$result = Test-SqlDscServerPermission -ServerRole $script:roleObject -Deny -Permission @('ViewServerState') -ErrorAction 'Stop'
227+
$result | Should -BeTrue
228+
}
229+
}
230+
231+
Context 'When attempting to set permissions for non-existent principal' {
232+
It 'Should throw an error for non-existent principal' {
233+
$permissionSet = New-Object -TypeName 'Microsoft.SqlServer.Management.Smo.ServerPermissionSet'
234+
$permissionSet.ViewServerState = $true
235+
236+
{
237+
Set-SqlDscServerPermission -ServerObject $script:serverObject -Name 'NonExistentPrincipal' -State 'Grant' -Permission $permissionSet -Force -ErrorAction 'Stop'
238+
} | Should -Throw
239+
}
240+
}
241+
}
242+

0 commit comments

Comments
 (0)